News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dylz on Sunday June 28, 2020 @07:59PM (#23673046)
You can no longer do webcrypto because the initial page is compromised.

Self signed HTTPS works for this case as long as you know the fingerprint/cert to accept.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by jopsen on Tuesday June 30, 2020 @06:37AM (#23688701)
Oh, yeah... webcrypto only works on HTTPS.

So you would need to ship a crypto library in JS, hehe :)

Self-signed certs probably does work, if you install the certificate root on your machine. It just not something you would advice end-users to do.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dylz on Tuesday June 30, 2020 @07:02AM (#23688826)
The other problem is shipping a crypto library if the entire page and script is not served over HTTPS means that it's no longer useful, because the crypto library is compromised.
[ Parent | on HN ]